[Esa-l] Magistr worm defanged but not caught

Brett Glass brett at lariat.org
Wed Aug 22 17:05:33 PDT 2001

Darn. Looks like the file names are random and the MIME
boundary string isn't constant. Will have to try to pull
a hex string out of the body of the worm.


At 02:55 PM 8/22/2001, Floyd Pierce wrote:

>I have one for you if you want.....
>Mime boundary:
>>Content-Type: application/octet-stream; name="OEMRNCE.23798DEFANGED-EXE"
>>Content-Transfer-Encoding: base64
>Floyd Pierce              | Director of Information Technology
>Phone  847-790-2830 (IL)  | Box USA
>Phone  817-783-2355 (TX)  | floydp at boxusa.com
>Fax    847-790-2880       | floyd at floydbob.com

More information about the esd-l mailing list